hfs 3.3.4 → 3.4.0-alpha2

package/src/langs/hfs-lang-zh.json

@@ -1,187 +1,189 @@
 {
-    "author": "yx3016 & MircoH0 & CMJNB & Cheuksing",
-    "version": 1.5,
-    "hfs_version": "0.57.5",
+    "author": "Hug3O",
+    "version": 1.2,
     "translate": {
         "Select": "选择",
-        "n_files": "{n} 个文件",
-        "n_folders": "{n} 个文件夹",
-        "filter_count": "{n} 符合筛选条件",
-        "select_count": "{n} 已选中",
-        "filter_placeholder": "输入筛选内容，对以下列表进行筛选",
+        "n_files": "{n,plural,one{# 文件} other{# 文件}}",
+        "n_folders": "{n,plural,one{# 文件夹} other{# 文件夹}}",
+        "filter_count": "{n,plural, one{# 个已筛选} other{# 个已筛选}}",
+        "select_count": "{n,plural, one{# 个已选择} other{# 个已选择}}",
+        "filter_placeholder": "在此输入以筛选下方列表",
         "Select some files": "选择一些文件",
-        "zip_checkboxes": "点击复选框选择文件，然后再次使用Zip进行打包！",
-        "zip_tooltip_selected": "将所选元素下载为单个ZIP文件",
-        "zip_tooltip_whole": "将整个列表（未过滤）下载为单个ZIP文件。若已选择部分元素，则仅下载这些元素。",
-        "zip_confirm_search": "是否将此次搜索的所有结果下载为ZIP压缩包？",
-        "zip_confirm_folder": "确认将整个文件夹下载为ZIP压缩包？",
-        "select_tooltip": "选择功能适用于“Zip”和“删除”操作，也可用于筛选列表。",
-        "delete_hint": "请先单击“选择”某个项目，方可执行删除操作。",
-        "delete_confirm": "确认删除 {n} 项？",
-        "delete_completed": "删除 {n} 项成功！",
-        "delete_failed": "删除失败，{n,plural, other{# 项失败}}",
+        "zip_checkboxes": "使用复选框选择文件，然后可以再次使用 Zip",
+        "zip_tooltip_selected": "将选中的元素作为单个 zip 文件下载",
+        "zip_tooltip_whole": "将整个列表（未筛选）作为单个 zip 文件下载。如果你选择了一些元素，则只下载那些元素。",
+        "zip_confirm_search": "将此搜索的所有结果下载为 ZIP 压缩包？",
+        "zip_confirm_folder": "将整个文件夹打包为ZIP再进行下载？",
+        "select_tooltip": "选择适用于“Zip”和“删除”（如果可用），但你也可以筛选列表",
+        "delete_hint": "要删除，请先点击“选择”",
+        "delete_confirm": "删除 {n,plural, one{# 个项目} other{# 个项目}}？",
+        "delete_completed": "删除：已完成 {n} 个",
+        "delete_failed": "，{n,plural, one{# 个失败} other{# 个失败}}",
         "delete_select": "选择要删除的内容",
         "Delete": "删除",
         "Options": "选项",
         "Search": "搜索",
-        "Zip": "压缩",
-        "search_msg": "搜索当前文件夹及其子文件夹",
-        "Searching": "搜索中...",
-        "Searched": "搜索完成！",
-        "Clear search": "清除搜索条件",
-        "Interrupted": "中断",
-        "stopped_before": "已停止",
-        "empty_list": "列表为空",
-        "filter_none": "无过滤条件",
-        "Admin-panel": "管理面板",
+        "Zip": "Zip",
+        "search_msg": "搜索此文件夹及子文件夹",
+        "Searching": "正在搜索",
+        "Searched": "已搜索",
+        "Clear search": "清除搜索",
+        "Interrupted": "已中断",
+        "stopped_before": "在找到任何内容之前已停止",
+        "empty_list": "这里什么都没有",
+        "filter_none": "没有与此筛选条件匹配的内容",
+        "alpha_idx": "字母索引",
+        "alpha_idx_button": "AZ",
+        "Admin-panel": "后台管理",
         "Login": "登录",
         "Username": "用户名",
         "Password": "密码",
-        "login_untrusted": "登录中止：服务器标识不可信！",
-        "login_bad_credentials": "凭证信息有误",
-        "login_bad_cookies": "Cookie错误 - 登录失败",
+        "login_untrusted": "登录已中止：无法信任服务器身份",
+        "login_bad_credentials": "凭据无效",
+        "confirm_url_login": "此链接正尝试以“{username}”身份登录你",
+        "login_bad_cookies": "Cookie 无法正常工作 - 登录失败",
         "User panel": "用户面板",
         "Change password": "更改密码",
         "enter_pass": "输入新密码",
-        "enter_pass2": "再次输入密码",
-        "pass2_mismatch": "两次输入的密码不一致，修改失败！",
-        "password_changed": "密码修改成功",
-        "Logout": "注销",
+        "enter_pass2": "再次输入相同的新密码",
+        "pass2_mismatch": "你输入的第二个密码与第一个不匹配。过程已中止。",
+        "password_changed": "密码已更改",
+        "Logout": "退出登录",
         "connection error": "连接错误",
         "Full timestamp:": "完整时间戳：",
         "Search was interrupted": "搜索已中断",
         "Stop list": "停止列表",
-        "download_starting": "开始下载",
-        "wrong_account": "用户 {u} 无访问权限，请更换用户",
-        "no_upload_here": "无上传权限",
+        "download_starting": "你的下载现在应开始",
+        "wrong_account": "账户 {u} 没有访问权限，请尝试其他账户",
+        "no_upload_here": "当前文件夹没有上传权限",
         "Create folder": "创建文件夹",
         "Pick files": "选择文件",
         "Pick folder": "选择文件夹",
-        "ready_to_upload": "{n,plural,other{# 个文件}}，{size}，准备上传",
+        "ready_to_upload": "{n,plural,one{# 个文件} other{# 个文件}}，{size}，准备上传",
         "Send": "发送",
         "Clear": "清除",
         "failed_upload": "无法上传 {name}",
-        "confirm_resume": "是否重命名？",
         "file too large": "文件过大",
         "Enter folder name": "输入文件夹名称",
         "Successfully created": "创建成功",
-        "enter_folder": "进入文件夹",
-        "folder_exists": "已存在同名文件夹",
-        "Sort by": "排序依据",
-        "name": "文件名",
-        "extension": "扩展名",
+        "enter_folder": "输入文件夹",
+        "folder_exists": "同名文件夹已存在",
+        "Sort by:": "排序：{by}",
+        "name": "文件名称",
+        "extension": "文件后缀",
         "size": "文件大小",
-        "time": "文件时间",
-        "Invert order": "倒序",
-        "Folders first": "文件夹优先",
+        "time": "修改时间",
+        "Invert order": "倒序排列",
+        "Folders first": "文件夹先",
         "Numeric names": "数字名称",
         "theme:": "主题：",
         "auto": "自动",
-        "light": "亮色",
-        "dark": "暗色",
-        "parent folder": "上级文件夹",
+        "light": "浅色",
+        "dark": "深色",
+        "parent folder": "父文件夹",
         "home": "主页",
         "Continue": "继续",
         "Confirm": "确认",
-        "Don't": "否",
+        "Don't": "不要",
         "Warning": "警告",
         "Error": "错误",
         "Info": "信息",
         "Unauthorized": "未授权",
-        "Forbidden": "禁止访问",
+        "Forbidden": "禁止",
         "Not found": "未找到",
         "Server error": "服务器错误",
         "Upload": "上传",
         "upload_concluded": "上传已结束：",
-        "upload_finished": "上传{n} 完成 ({size})",
-        "upload_errors": "上传失败{n} 次",
-        "upload_file_rejected": "部分文件被服务器拒绝接收",
-        "delete_unfinished_upload": "要移除未完成的上传吗？",
+        "upload_finished": "{n} 个已完成（{size}）",
+        "upload_errors": "{n} 个失败",
+        "upload_file_rejected": "某些文件未被接受",
+        "delete_unfinished_upload": "删除未完成的上传？",
         "File menu": "文件菜单",
         "Folder menu": "文件夹菜单",
         "Name": "名称",
         "file_open": "打开",
         "Download": "下载",
-        "Missing permission": "权限不足",
+        "Missing permission": "缺少权限",
         "Reload": "重新加载",
         "Get list": "获取列表",
-        "Skip existing files": "跳过已存在的文件",
+        "Skip existing files": "跳过现有文件",
         "Size": "大小",
-        "Timestamp": "时间戳",
-        "Show": "显示/播放",
+        "Timestamp": "修改时间",
+        "Show": "显示",
         "Loading failed": "加载失败",
+        "Download limit reached": "已达到下载数量上限",
+        "Retry": "重试",
         "Rename": "重命名",
         "Tiles mode:": "平铺模式：",
         "off": "关闭",
         "Operation successful": "操作成功",
         "Uploader": "上传者",
-        "Download counter": "下载次数",
+        "Download counter": "下载计数器",
         "Switch zoom mode": "切换缩放模式",
         "Full screen": "全屏",
         "File Show help": "文件显示帮助",
-        "showHelpMain": "您可以使用键盘执行以下操作：",
+        "showHelpMain": "你可以使用键盘执行一些操作：",
         "showHelp_←/→": "←/→",
         "showHelp_↑/↓": "↑/↓",
         "showHelp_space": "空格",
         "showHelp_←/→_body": "转到上一个/下一个文件",
-        "showHelp_↑/↓_body": "滚动长图",
-        "showHelp_space_body": "选择",
-        "showHelp_D_body": "下载",
-        "showHelp_Z_body": "缩放模式",
-        "showHelp_F_body": "全屏",
-        "Destination": "目标位置",
-        "in_queue": "{n} 个在队列中",
-        "enter_comment": "对此文件的评论",
-        "Comment": "评论",
-        "upload_dd_hint": "您可以将文件拖放到文件列表中进行上传",
+        "showHelp_↑/↓_body": "滚动长图片",
+        "Destination": "目标",
+        "in_queue": "队列中有 {n} 个",
+        "enter_comment": "为 {name} 添加注释",
+        "Comment": "注释",
+        "upload_dd_hint": "你可以通过将文件拖放到文件列表上来上传文件",
         "Upload not available": "上传不可用",
         "Cut": "剪切",
-        "n_items": "{n,plural, other{# 个项目}}",
-        "move_results": "{good} 个已移动，{bad} 个失败",
-        "after_cut": "您的选择已成功添加到剪贴板，请前往目标文件夹粘贴。",
+        "n_items": "{n,plural, one{# 个项目} other{# 个项目}}",
+        "move_results": "{good} 个已移动{bad,plural, =0{} other{，# 个失败}}",
+        "after_cut": "你的选择现在已在剪贴板中。\n转到目标文件夹进行粘贴。",
         "Cancel clipboard": "取消剪贴板",
         "to_clipboard_source": "返回源文件夹",
         "Paste": "粘贴",
-        "clipboard_list": "剪贴板文件：",
+        "clipboard_list": "剪贴板中的项目：",
         "Close": "关闭",
         "Folder": "文件夹",
         "Web page": "网页",
         "Link": "链接",
         "Auto-play": "自动播放",
-        "autoplay_seconds": "图片间隔秒数",
+        "autoplay_seconds": "图片等待秒数",
         "Select all": "全选",
-        "go_first": "跳转到第一个项目",
-        "go_last": "跳转到最后一个项目",
+        "go_first": "转到第一项",
+        "go_last": "转到最后一项",
         "Shuffle": "随机播放",
         "Repeat": "重复",
-        "showHelpListShortcut": "在文件列表中，按住 {key} 点击可快速显示",
+        "showHelpListShortcut": "在文件列表中，按住 {key} 点击可显示",
         "Invalid value": "无效值",
-        "upload_interrupted": "{n} 中断",
+        "upload_interrupted": "{n} 个已中断",
         "Overwrite policy": "覆盖策略",
         "Rename to avoid overwriting": "重命名以避免覆盖",
-        "Overwrite existing files": "覆盖已存在的文件",
+        "Overwrite existing files": "覆盖现有文件",
         "Menu": "菜单",
-        "clipboard": "剪贴板 ({content})",
-        "to_clipboard_source_tooltip": "前往剪贴板内容所在的文件夹",
+        "clipboard": "剪贴板（{content}）",
+        "to_clipboard_source_tooltip": "转到剪贴板内容所在的文件夹",
         "more_items": "还有 {n} 个项目",
-        "Show details": "显示详细信息",
+        "Show details": "显示详情",
         "upload_conflict": "已存在",
         "Logged in": "已登录",
-        "Logged out": "已注销",
+        "Logged out": "已退出登录",
         "Cancel": "取消",
-        "allow_session_ip_change": "允许会话期间IP变更",
-        "focus_hint": "您可以通过键盘输入快速搜索并选择列表中的项目。",
+        "allow_session_ip_change": "允许此会话期间 IP 变更",
+        "focus_hint": "通过在键盘上输入，你可以搜索并聚焦列表中的项目。",
         "copy_links": "复制链接",
-        "Calculate": "计算",
+        "Calculate": "统计",
         "Creation": "创建时间",
-        "creation": "创建",
-        "required_change_password": "您需要更改密码",
+        "creation": "创建时间",
+        "required_change_password": "你需要更改密码",
         "Wildcards": "通配符",
-        "Considering resume": "正在尝试恢复上传",
+        "Considering resume": "考虑恢复",
         "Yes": "是",
         "No": "否",
-        "esc_again": "按 ESC 两次关闭",
+        "esc_again": "按两次 ESC 关闭",
         "insufficient storage": "存储空间不足",
-        "Account disabled": "账户已禁用"
+        "Account disabled": "账户已停用",
+        "upload_name": "使用新名称上传",
+        "Uploading": "正在上传",
+        "proxy_413": "请检查代理服务器上的此限制"
     }
 }

package/src/listen.js

@@ -74,7 +74,12 @@ const sessionStamp_1 = require("./sessionStamp");
 let httpSrv;
 let httpsSrv;
 // the update relaunch can keep a bridge process alive, so we proactively close listeners here to release ports before the next binary binds; do it before (5) the storage file is closed, because sockets write there
-(0, first_1.onProcessExit)(() => Promise.all([stopServer(httpSrv), stopServer(httpsSrv)]), 5);
+(0, first_1.onProcessExit)(() => {
+    const stopped = Promise.all([stopServer(httpSrv), stopServer(httpsSrv)]);
+    for (const { socket } of (0, connections_1.getConnections)()) // closeAllConnections misses TCP sockets awaiting TLS and connections upgraded by plugins
+        socket.destroy();
+    return stopped;
+}, 5);
 const openBrowserAtStart = (0, config_1.defineConfig)(misc_1.CFG.open_browser_at_start, true);
 exports.baseUrl = (0, config_1.defineConfig)(misc_1.CFG.base_url, '', x => /(?<=\/\/)[^\/]+/.exec(x)?.[0]); // compiled is host only
 async function getBaseUrlOrDefault() {
@@ -303,8 +308,6 @@ function stopServer(srv) {
                 console.debug("Failed to stop server", String(err));
             resolve(err);
         });
-        if (first_1.quitting)
-            srv.closeAllConnections();
     });
 }
 function getCurrentPort(srv) {

package/src/log.js

@@ -48,6 +48,7 @@ const lodash_1 = __importDefault(require("lodash"));
 const util_files_1 = require("./util-files");
 const auth_1 = require("./auth");
 const misc_1 = require("./misc");
+const vfs_1 = require("./vfs");
 const path_1 = require("path");
 const yazl_1 = __importDefault(require("yazl"));
 const promises_1 = require("stream/promises");
@@ -109,6 +110,7 @@ const logRotation = (0, config_1.defineConfig)(misc_1.CFG.log_rotation, 'weekly'
 const dontLogNet = (0, config_1.defineConfig)(misc_1.CFG.dont_log_net, '127.0.0.1|::1', v => (0, misc_1.makeNetMatcher)(v));
 const logUA = (0, config_1.defineConfig)(misc_1.CFG.log_ua, false);
 const logSpam = (0, config_1.defineConfig)(misc_1.CFG.log_spam, false);
+const logSpamRegex = (0, config_1.defineConfig)(misc_1.CFG.log_spam_regex, /wlwmanifest.xml$|\.(php|asp)$|cgi|robots.txt$/.source, v => v ? new RegExp(v) : null);
 const logHost = (0, config_1.defineConfig)(misc_1.CFG.log_host, false);
 const debounce = lodash_1.default.debounce(cb => cb(), 1000); // with this technique, i'll be able to debounce some code respecting the references in its closure
 const logMw = async (ctx, next) => {
@@ -122,7 +124,9 @@ const logMw = async (ctx, next) => {
     if (!logSpam.get()
         && (ctx.querystring.includes('{.exec|') // v2's bug
             // requests generated by security scanners, other bots, and macos' finder
-            || ctx.status === misc_1.HTTP_NOT_FOUND && /wlwmanifest.xml$|\.(php)$|cgi|robots.txt$/.test(ctx.path))) {
+            || logSpamRegex.compiled()?.test(ctx.path)
+                && (ctx.status === misc_1.HTTP_NOT_FOUND
+                    || ctx.status === misc_1.HTTP_TEMPORARY_REDIRECT_KEEP_METHOD && !await (0, vfs_1.urlToNode)(ctx.path, ctx)))) {
         events_2.default.emit('spam', ctx);
         return;
     }
@@ -140,6 +144,8 @@ const logMw = async (ctx, next) => {
         let { stream, last, path } = logger;
         if (!stream)
             return;
+        if (events_2.default.emit('beforeLog', { ctx })?.isDefaultPrevented())
+            return;
         const rotate = logRotation.get()?.[0];
         const reqEnd = logger.last = new Date();
         if (rotate && last) { // rotation enabled and a file exists?

package/src/middlewares.js

@@ -4,13 +4,12 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.sessionMiddleware = exports.paramsDecoder = exports.prepareState = exports.blockFilter = exports.prepareConnection = exports.someSecurity = exports.cloudflareDetected = exports.headRequests = exports.gzipper = exports.sessionDuration = void 0;
+exports.sessionMiddleware = exports.paramsDecoder = exports.prepareState = exports.blockFilter = exports.prepareConnection = exports.someSecurity = exports.cloudflareDetected = exports.gzipper = exports.sessionDuration = void 0;
 exports.getProxyDetected = getProxyDetected;
 exports.failAllowNet = failAllowNet;
 const koa_compress_1 = __importDefault(require("koa-compress"));
 const const_1 = require("./const");
 const misc_1 = require("./misc");
-const stream_1 = require("stream");
 const block_1 = require("./block");
 const perm_1 = require("./perm");
 const connections_1 = require("./connections");
@@ -24,6 +23,9 @@ const config_1 = require("./config");
 const koa_session_1 = __importDefault(require("koa-session"));
 const index_1 = require("./index");
 const events_1 = __importDefault(require("./events"));
+const node_crypto_1 = require("node:crypto");
+const lang_1 = require("./lang");
+const i18n_1 = require("./i18n");
 const forceHttps = (0, config_1.defineConfig)(misc_1.CFG.force_https, true);
 (0, config_1.defineConfig)(misc_1.CFG.ignore_proxies, false);
 const allowAuthorizationHeader = (0, config_1.defineConfig)(misc_1.CFG.authorization_header, true);
@@ -38,21 +40,6 @@ exports.gzipper = (0, koa_compress_1.default)({
         return /text|javascript|style/i.test(type);
     },
 });
-const headRequests = async (ctx, next) => {
-    const head = ctx.method === 'HEAD';
-    if (head)
-        ctx.method = 'GET'; // let other middlewares work, so we can collect the size at the end
-    await next();
-    if (!head || ctx.body === undefined)
-        return;
-    const { length, status } = ctx.response;
-    if (ctx.body)
-        ctx.body = stream_1.Readable.from(''); // empty the body for this is a HEAD request. Using Readable avoids koa from trying to set length to 0
-    ctx.status = status;
-    if (length)
-        ctx.response.length = length;
-};
-exports.headRequests = headRequests;
 let proxyDetected;
 const someSecurity = (ctx, next) => {
     enforceSessionIp(ctx);
@@ -65,15 +52,53 @@ const someSecurity = (ctx, next) => {
         const { URL } = ctx;
         URL.protocol = 'https';
         URL.port = (0, listen_1.getHttpsWorkingPort)();
-        ctx.status = 307; // this ensures the client doesn't switch to a simpler GET request
+        ctx.status = const_1.HTTP_TEMPORARY_REDIRECT_KEEP_METHOD; // this ensures the client doesn't switch to a simpler GET request
         return ctx.redirect(URL.href);
     }
+    const page = ctx.state.urlLoginPage;
+    if (page)
+        return sendUrlLoginPage(page.cleanUrl, page.username);
     return next();
+    function sendUrlLoginPage(cleanUrl, username) {
+        return sendPage(ctx, username === undefined ? 'login_bad_credentials' : 'Confirm', t => {
+            if (username === undefined)
+                return `<script>history.replaceState(null,'',location.pathname)</script>
+                    <p><a href="${(0, misc_1.escapeHTML)(cleanUrl)}">${(0, misc_1.escapeHTML)(t('Continue'))}</a></p>`;
+            const token = (0, node_crypto_1.randomUUID)();
+            (ctx.session ??= {}).urlLoginConfirmation = {
+                token,
+                username,
+                expires: Date.now() + 5 * 60_000,
+            };
+            return `<p>${(0, misc_1.escapeHTML)(t('confirm_url_login', { username }))}</p>
+                <p><strong><a class="confirm" href="${(0, misc_1.escapeHTML)(cleanUrl)}">${(0, misc_1.escapeHTML)(t('Continue'))}</a></strong>
+                <a href="${(0, misc_1.escapeHTML)(cleanUrl)}">${(0, misc_1.escapeHTML)(t('Cancel'))}</a></p>
+                <script>
+                    const loginUrl=new URL(location.href);
+                    history.replaceState(null,'',loginUrl.pathname);
+                    document.querySelector('.confirm').onclick=ev=>{ev.preventDefault();loginUrl.searchParams.set('login_confirm','${token}');location.replace(loginUrl)}
+                </script>`;
+        });
+    }
 };
 exports.someSecurity = someSecurity;
+async function sendPage(ctx, titleKey, content) {
+    const { t } = (0, i18n_1.i18nFromTranslations)(await (0, lang_1.getLangData)(ctx));
+    const title = t(titleKey);
+    ctx.status = 200;
+    ctx.type = 'html';
+    ctx.set('cache-control', 'no-store');
+    ctx.set('referrer-policy', 'no-referrer');
+    ctx.set('content-security-policy', "frame-ancestors 'none'");
+    ctx.set('x-frame-options', 'DENY');
+    ctx.body = `<!DOCTYPE html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+        <title>${(0, misc_1.escapeHTML)(title)}</title><style>
+        body{margin-top:30vh;text-align:center;font-family:sans-serif}a{margin:1em}
+        </style></head><body><h1>${(0, misc_1.escapeHTML)(title)}</h1>${content(t)}</body></html>`;
+}
 const prepareConnection = (ctx, next) => {
     // normalize once so auth, filters and logging agree on the same client address
-    ctx.request.ip = (0, connections_1.normalizeIp)(ctx.ip);
+    ctx.request.ip = (0, misc_1.normalizeIp)(ctx.ip);
     ctx.state.connection = (0, connections_1.socket2connection)(ctx.socket);
     (0, connections_1.updateConnectionForCtx)(ctx);
     return next();
@@ -99,6 +124,7 @@ function getProxyDetected() {
     return proxyDetected && { from: proxyDetected.socket.remoteAddress, for: proxyDetected.get('X-Forwarded-For') };
 }
 const prepareState = async (ctx, next) => {
+    ctx.state.getOrHead = ctx.method === 'GET' || ctx.method === 'HEAD';
     // invalidate before account resolution; someSecurity calls again to bind logins made below
     enforceSessionIp(ctx);
     // rootsMiddleware consults proxy-aware admin access before someSecurity runs
@@ -125,7 +151,9 @@ const prepareState = async (ctx, next) => {
     }
     // explicit credentials and existing sessions must take precedence, so a matching IP cannot override a chosen account
     let via;
-    let a = await urlLogin() || await getHttpAccount() || !s?.username && autoLogin();
+    const urlAccount = await urlLogin();
+    let a = ctx.state.urlLoginPage ? undefined
+        : urlAccount || await getHttpAccount() || !s?.username && autoLogin();
     const loggedInNotBySession = a;
     ctx.state.account = a ||= (0, perm_1.getAccount)(s?.username, false); // with least precedence, we consider session
     if (a)
@@ -147,14 +175,43 @@ const prepareState = async (ctx, next) => {
     ctx.state.revProxyPath = ctx.get('x-forwarded-prefix');
     (0, connections_1.updateConnectionForCtx)(ctx); // publish the resolved account after the initial pre-auth connection update
     await next();
-    function urlLogin() {
+    async function urlLogin() {
         via = 'url';
         const { login } = ctx.query;
         if (!login)
             return;
         const [u, p] = (0, misc_1.splitAt)(':', String(login));
-        ctx.redirect(ctx.originalUrl.slice(0, -ctx.querystring.length - 1)); // redirect to hide credentials
-        return u && (0, auth_1.clearTextLogin)(ctx, u, p, 'url');
+        const cleanUrl = ctx.originalUrl.slice(0, -ctx.querystring.length - 1);
+        const token = String(ctx.query.login_confirm || '');
+        const pending = s?.urlLoginConfirmation;
+        const confirmed = Boolean(token && pending?.token === token && pending.username === u
+            && pending.expires > Date.now());
+        if (token && s)
+            delete s.urlLoginConfirmation; // confirmation tokens are single-use, including failed attempts
+        if (!confirmed && needsConfirmation(u)) {
+            ctx.state.urlLoginPage = { username: u, cleanUrl };
+            return;
+        }
+        if (s)
+            delete s.urlLoginConfirmation;
+        const account = u && await (0, auth_1.clearTextLogin)(ctx, u, p, 'url');
+        if (!account && confirmed)
+            ctx.state.urlLoginPage = { cleanUrl };
+        else
+            ctx.redirect(cleanUrl); // redirect to hide credentials
+        return account;
+        function needsConfirmation(username) {
+            if (ctx.get('sec-fetch-mode') !== 'navigate' && !/^Mozilla\//.test(ctx.get('user-agent')))
+                return false;
+            const current = s?.username;
+            if (current)
+                return (0, perm_1.getAccount)(username)?.username !== (0, perm_1.getAccount)(current)?.username;
+            const fetchSite = ctx.get('sec-fetch-site');
+            if (fetchSite)
+                return fetchSite === 'same-site' || fetchSite === 'cross-site';
+            const referer = ctx.get('referer');
+            return !referer || (0, misc_1.try_)(() => new URL(referer).host.toLowerCase() !== ctx.host.toLowerCase(), () => true);
+        }
     }
     function getHttpAccount() {
         via = 'header';
@@ -185,20 +242,19 @@ const prepareState = async (ctx, next) => {
 };
 exports.prepareState = prepareState;
 function failAllowNet(ctx, a) {
-    // a cached mask is valid only for the identity that stored it
-    const sameAccount = ctx.session?.username === (0, perm_1.normalizeUsername)(a?.username || '');
-    const cached = sameAccount ? ctx.session?.allowNet : undefined;
-    const mask = cached ?? (0, perm_1.getFromAccount)(a || '', a => a.allow_net);
-    if (sameAccount && !cached && mask)
-        ctx.session.allowNet = mask; // must be deleted on logout by setLoggedIn
+    const mask = (0, perm_1.getFromAccount)(a || '', a => a.allow_net);
     const ret = mask && !(0, misc_1.netMatches)(ctx.ip, mask, true);
     if (ret)
         console.debug("Login failed: allow_net");
     return ret;
 }
 const paramsDecoder = async (ctx, next) => {
-    ctx.state.params = ctx.method === 'POST' && ctx.originalUrl.startsWith(const_1.API_URI)
-        && ((0, misc_1.tryJson)(await (0, misc_1.stream2string)(ctx.req)) || {});
+    if (ctx.method !== 'POST' || !ctx.originalUrl.startsWith(const_1.API_URI))
+        return next();
+    const body = await (0, misc_1.readRequestBodyLimited)(ctx, 10 * 1024 * 1024);
+    if (!body)
+        return;
+    ctx.state.params = (0, misc_1.tryJson)(body.text) || {};
     await next();
 };
 exports.paramsDecoder = paramsDecoder;

package/src/multipartUpload.js

@@ -11,9 +11,15 @@ const upload_1 = require("./upload");
 const cross_const_1 = require("./cross-const");
 const first_1 = require("./first");
 const cross_1 = require("./cross");
+const config_1 = require("./config");
 async function handleMultipartUpload(ctx, node) {
     if (ctx.request.type !== 'multipart/form-data')
         return ctx.status = cross_const_1.HTTP_BAD_REQUEST;
+    if (isCrossOriginBrowserRequest()) {
+        ctx.set('Connection', 'close'); // the rejected multipart body is intentionally left unread
+        ctx.body = "Cross-origin multipart upload blocked";
+        return ctx.status = cross_const_1.HTTP_FOOL;
+    }
     ctx.state.uploads = [];
     const locks = [];
     const fileJobs = [];
@@ -73,6 +79,20 @@ async function handleMultipartUpload(ctx, node) {
         stream.resume();
         return new Promise(res => (0, first_1.onFirstEvent)(stream, ['end', 'close', 'error'], res));
     }
+    function isCrossOriginBrowserRequest() {
+        if (ctx.get('x-hfs-anti-csrf'))
+            return false;
+        const origin = ctx.get('origin');
+        if (origin && origin !== 'null' && allowedUploadOrigin.compiled()(origin))
+            return false;
+        const fetchSite = ctx.get('sec-fetch-site');
+        if (fetchSite)
+            return fetchSite !== 'same-origin' && fetchSite !== 'none';
+        if (!origin)
+            return false; // missing browser metadata preserves non-browser and legacy upload clients
+        // compare hosts because TLS termination can make the public and internal protocols differ
+        return (0, cross_1.try_)(() => new URL(origin).host.toLowerCase() !== ctx.host.toLowerCase(), () => true);
+    }
     async function subfolderBlocksUpload(fn) {
         const prefix = (0, path_1.dirname)(fn.replaceAll('\\', '/'));
         if (prefix === '.') // no subdir
@@ -81,3 +101,4 @@ async function handleMultipartUpload(ctx, node) {
         return subfolderNode && !(0, vfs_1.hasPermission)(subfolderNode, 'can_upload', ctx);
     }
 }
+const allowedUploadOrigin = (0, config_1.defineConfig)('allowed_upload_origin', '', mask => (0, cross_1.makeMatcher)(mask, false, false));